Node.js developers face constant bot traffic. Instead of chasing perfect human detection, a new open‑source package, request‑risk‑score, assigns a 0‑to‑100 risk score to each HTTP request. The lightweight, privacy‑first tool relies on transparent heuristics, sidestepping browser fingerprinting and external APIs and stays safe for search engine crawlers without compromising performance.

Developers install it via npm and call analyzeRequest with IP, headers, and URL. The library returns a score, a risk bucket, and signal tags like “tool_user_agent” or “no_cookies.” This probabilistic output lets teams decide when to block or challenge traffic, especially useful for small APIs lacking a Web Application Firewall.

By focusing on risk rather than outright blocking, the tool encourages smarter traffic filtering and preserves legitimate bot traffic such as search crawlers. As Node.js services grow, integrating request‑risk‑score can reduce false positives and lower maintenance overhead. Watch for future updates that may add machine‑learning enhancements to further refine detection.